Cybersecurity Giant F5 Suffers Major Source Code Heist by Hackers

Cybersecurity Giant F5 Suffers Major Source Code Heist by Hackers

• F5 says nation-state hackers stole part of its BIG-IP source code
• The stolen files include information on vulnerabilities F5 had not yet disclosed
• F5 has released security updates, and CISA ordered federal agencies to act
• Customers are urged to patch and lock down management interfaces

What F5 disclosed

Source-code theft at a major security vendor matters because it can create downstream risk well beyond the initial victim, especially if attackers gain insight into internal tooling, product logic, or customer-facing components. The F5 incident is important less for the headline alone and more for what it says about supply-chain exposure, escalation risk, and the need for rapid containment even inside companies that sell security for a living.

F5 disclosed on October 15, 2025, that a highly sophisticated nation-state threat actor had long-term access to some of its systems, including the BIG-IP product development environment and an engineering knowledge management platform. The attackers took files containing portions of BIG-IP source code and information about undisclosed vulnerabilities F5 was working on. F5 says it learned of the intrusion on August 9, 2025.

Who is behind it

F5 attributed the attack to a nation-state actor without naming a country. Media reports have linked it to China-nexus hackers. F5 said it has seen no evidence that the undisclosed vulnerabilities have been exploited, and none that the attackers modified its software supply chain.

The company also said some exfiltrated files from its knowledge platform contained configuration or implementation information for a small percentage of customers, and that it would contact those customers directly.

What it means for customers

F5’s BIG-IP products sit in front of applications and networks at thousands of organizations, including banks, hospitals and government agencies. With source code and vulnerability details in hand, attackers have a head start on finding and exploiting flaws in those devices.

Hence the urgency.

The response

F5 released updates for BIG-IP, F5OS, BIG-IQ and its APM clients and urged customers to install them as soon as possible. It brought in outside security firms to investigate and has been working with law enforcement and government partners.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 26-01, ordering federal agencies to inventory their F5 devices, apply updates, remove management interfaces from public internet access and disconnect devices that no longer get support.

Patch and lock down

Patch every F5 device, starting with anything exposed to the internet. Check that management interfaces are not reachable from outside, review logs for suspicious activity and replace devices past end of support.

Watch for new F5 advisories, since more fixes may follow as the vulnerability information the attackers took is worked through.

What to watch

Watch for signs of exploitation of F5 devices in the wild and for any further attribution from governments. A breach at a security vendor turns its customers into targets.

Patch now.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.